Proxies for Yelp

In the same place as everyone collecting from any major platform: bound by a contract term, not a statute. Yelp's terms prohibit automated access — unusually bluntly, even naming third-party scraping software — and that prohibition is real: it's the legal basis for the blocking this page describes, and for account termination if you collect while logged in. What it isn't is criminal law. US courts have generally treated collection of publicly accessible, logged-out data favorably (the hiQ v. LinkedIn line of cases is the usual citation), and a whole industry of local-SEO and reputation platforms visibly operates on Yelp data. The lines worth drawing yourself are sharper than the ToS: stay logged out (authenticated scraping converts a contract question into something worse); treat review text carefully — it's user-generated content that Yelp licenses, so analyze sentiment rather than republishing corpora; treat reviewer names and avatars as personal data and drop them unless your analysis needs them; and pace politely, because degrading the service is where abstract risk becomes concrete. For a commercial product built on the feed, one counsel review is standard diligence.

Probably not the one you're tuning. Yelp's protection is DataDome-class and layered, and each layer has a different tell. If challenges arrive on the first request from a fresh address, before any volume accumulates, the trigger is classification, not behavior — either the address range itself (hosting-provider origin scored down as a category) or your client's TLS handshake announcing an HTTP library instead of a browser; fix the client first (browser-grade TLS impersonation), and if clean dedicated addresses still get challenged on arrival, that target slice wants consumer-registered ISP addresses. If challenges arrive after a run of successes, that's the per-IP meter — and note it's endpoint-sensitive: search and category pages throttle several times harder than individual business pages, so a crawl that's fine on listings can trip on pagination. Also check what a “success” contains: Yelp sometimes serves 200-OK pages with the data quietly stripped, so validate content, not status codes. The general rule from a run of these diagnoses: first-request friction means change what you present; late friction means change how fast you ask.

Fewer than the scary per-IP numbers suggest, because listing work is shallow. The arithmetic: practitioners hold sustained Yelp collection at roughly 10–15 requests per hour per address — glacial by scraping standards — but a metro-area category sweep is not that many requests. One search page returns ten businesses; a category with 600 businesses in a metro is ~60 search pages plus 600 detail pages, call it 700 requests. Twenty addresses at 12 requests per hour clear it in about three hours; a 100-IP package — the size our packages start at — does it in under an hour, or covers five categories in the same afternoon. What changes the math is depth: review pagination multiplies per-business requests by the review-page count and is exactly the surface Yelp throttles hardest, so a reputation archive wants both a wider pool and more patience than a contact list. Practical sizing rule: count your request total, divide by 12 per IP-hour, and buy the width that fits your deadline — then keep 20% idle as rotation reserve for addresses that draw a challenge and need to sit out.

Collecting the contacts and contacting them are two different compliance questions, and the second one has nothing to do with proxies. The collection side is the comfortable half: a business's name, address, phone, and category on a public directory page is commercial information the business itself published to be found — it's about as far from sensitive personal data as scraped content gets. The outreach side is regulated on its own terms regardless of where the list came from: in the US, cold email to businesses is legal under CAN-SPAM if you identify yourself, include a physical address, and honor opt-outs; cold calling runs into TCPA the moment autodialers or prerecorded messages are involved, and B2B does not exempt you from the Do-Not-Call rules for individuals' numbers; texting is stricter still. Two practical notes from how lead-gen teams actually use this data: enrich before you outreach (review volume and rating trends tell you who's growing or hurting — better targeting beats bigger lists), and keep the provenance clean — a list you built from public pages is defensible, while a purchased list of unknown origin is someone else's compliance problem becoming yours.